How to Move a Policy Review from Copilot Cowork to Copilot in SharePoint

If your policy review only reads from one SharePoint library, you can run it in Copilot in SharePoint instead of Copilot Cowork. One prompt finds the overdue policies, checks their tagging, writes each policy owner a report, builds a dashboard and shares the reports once you approve. Work like this is included with the Microsoft 365 Copilot licence.

The Cowork version of this review used 248 Copilot Credits for a single run, about US$2.48 at the pay-as-you-go rate of one cent a credit. It’s a pattern I’m seeing with clients at the moment: Cowork becomes the default for anything with more than one step, including recurring jobs that never leave a single site, and once one of those goes on a schedule or several people run their own copy, the credits keep adding up.

Why was the Cowork policy review costing more than it needed to?

The Cowork task was producing a policy review dashboard, two Excel files and a Word document, and drafting emails to send reports to policy owners. When I looked at those three files, they were all registers: lists of policies with their owners and review dates.

The policy library already held that information. Every policy had owner, approver, category, audience and review date columns. Each Cowork run was rebuilding a copy of the library’s metadata, and that copy was out of date as soon as someone updated a policy.

We dropped the registers entirely. The library is the register. What the team actually needed was reporting on top of it, and Copilot in SharePoint can do that from inside the site, right next to the data.

Here’s how the two versions compared in my demo:

For a recurring job that stays inside one library, I’d run it in Copilot in SharePoint. If your library is still organised by folders, moving to metadata columns comes first, because the prompt below depends on them.

Before you start

• Licence. Copilot in SharePoint needs a Microsoft 365 Copilot licence. It began rolling out to general availability on 30 September 2026.
• Columns on the library. You need a column for each thing the report has to filter or group by. Mine were owner, approver, category, audience and review date. Adding metadata columns to a document library covers the setup.
• A SHAREPOINT.md file and a brand skill (optional). Neither is required for the review to run, but both shaped the output in my demo, as described in step 3.

How to run the policy review in Copilot in SharePoint

1. Open Copilot in SharePoint on the site that holds the policy library.

2. Paste one prompt that covers the whole job. Mine asked Copilot to find every overdue policy, review each one and check whether the category and audience columns fit what the policy actually covers, draft an HTML report for each policy owner listing their overdue and upcoming policies, share each report with its owner, and build an HTML dashboard focused on overdue and review dates with filters for owner and approver and a register underneath. The prompt in the video was longer and spoken as I typed. This is a tidied version you can adapt; I’ve added the 30-day window and the approver column, so test it in your own library:

   Find every policy in this library that is overdue for review or due in the
   next 30 days. For each one, check whether the Category and Audience columns
   fit what the policy actually covers, and flag any that don't.
   Create an HTML report for each policy owner listing their overdue and
   upcoming policies and the approver for each. Share each report with its owner.
   Then create an HTML dashboard of all policies focused on overdue and review
   dates, with filters for owner and approver, and a full register underneath.
   

3. Let the site’s setup do its part. Copilot loaded the site’s SHAREPOINT.md file, which loads into every conversation anyone has with Copilot in SharePoint on that site and keeps the way the site works consistent. It also called my HTML brand skill without being asked, because that skill tells Copilot to follow the brand whenever it generates an HTML dashboard, report or file. What SHAREPOINT.md is and what goes in it covers the first; how SharePoint skills work covers the second.

4. Approve the share. Copilot built all three reports, then stopped and waited for my approval before sharing anything with the policy owners.

5. Check the outputs. The dashboard had owner and approver filters, counts of what was overdue and what was due in the next 30 days, a summary at the top that changed with the status filter, and a search box. Frankie’s owner report showed four policies overdue and five due in the next 30 days, with me listed as the approver on each. The dashboard, Frankie’s report and my own report all came out in the same branded design.

6. Save it as a site skill. In the same chat, Copilot asked: “Should I save the policy review owner reports as a site skill?” I said yes. Anyone who manages policies on that site can now ask for the review and get the same reports, on demand, without rewriting the prompt.

Move a job out of Cowork only when it stays on one site

Cowork is built for multi-step work that spans Microsoft 365. When I’m looking at a recurring Cowork task, I ask where the information already lives. If it’s in a library with decent metadata, Cowork is mostly duplicating it, and Copilot in SharePoint can report on the library directly. If the job pulls from Outlook, Teams chats or several sites, Cowork still earns its keep.

The second thing I look at is who the job belongs to. A policy review is run by whoever owns policies this quarter. Left as one person’s Cowork task, the know-how leaves when they do. As a site skill, with SHAREPOINT.md and a brand skill alongside it, the process belongs to the site, and a new policy owner gets the same reports from the same request. Decide who can change that skill, though. The SharePoint skills article covers who can edit site skills and how I lock that down.

The third question is where the human sits. Finding overdue policies and building reports can run without me. Putting a report in front of a colleague is the step they act on, so that’s where I keep the approval.

Be careful about scheduling, too. Microsoft lists skills in scheduled AI automations as a Copilot Credits capability, so a scheduled policy review is metered again. I’d keep this one on demand and let the policy owner run it when they need the reports.

What to watch for

• Credit prompts. When a prompt needs an advanced capability or crosses the threshold of working at scale, Copilot in SharePoint asks you to approve credit use before it continues. My recording doesn’t show a credit figure for the SharePoint run, so check this in your own tenant.
• Column quality. The category and audience check catches tagging that doesn’t fit the policy. It can’t fix an owner or review date that was never filled in, and those two columns drive every report.
• Permissions. Copilot works within the permissions of the person running the prompt, and a site skill never gives anyone access they didn’t already have.

This review tracks when policies are due and who owns them. Making the policy itself easier to use is a different job, which I cover in why your SharePoint policies should be interactive HTML pages. For how Cowork costs vary by model, see Copilot Cowork models: what each one actually costs.

Frequently asked questions

Does a policy review in Copilot in SharePoint use Copilot Credits? Microsoft’s Get started with Copilot in SharePoint page (checked 30 October 2026) includes creating HTML files, sharing individual files and creating skills in the Microsoft 365 Copilot licence, and bills large-scale document review and skills in scheduled AI automations through Copilot Credits.

Where is a site skill saved, and who can run it? Copilot saves a site skill as a SKILL.md file in the site’s Agent Assets library, at Agent Assets/Skills//SKILL.md. Anyone with View permission on the site can run it, and anyone with Edit permission can create or change site skills.

Does this only work for policies? I’ve only run it on policies, but the pattern fits any library where each document has an owner and a date, such as contracts coming up for renewal, procedures due for review or supplier certificates about to expire.